MALICIOUS — 7e6393c9d4696e35e70d0c6eaee2e338bb2567debd950023176c25cf92289340

MALICIOUS — 7e6393c9d4696e35e70d0c6eaee2e338bb2567debd950023176c25cf92289340 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 7e6393c9d4696e35e70d0c6eaee2e338bb2567debd950023176c25cf92289340
SHA-1: 0e574fd233fcde1f637dd69b975391588e25ec63
MD5: dd0642f0fc3ac77768cc717fb7f8737b
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 1536:3UUUUUUUUUUHdTD+vvvvvvvvvh+UUUUUUUC9mIkkkkkkTyhhhhhhhMqg1Ih0bJI/:blN9RkkkkkkTLq8Ih0dIl2GbMrKJl
TLSH: T1B93DE240317A38CCD7649E6115349D9DA12152C18A7D2DE68B034B6C3C678BBBCD8FB6
Submitted as: 7e6393c9d4696e35e70d0c6eaee2e338bb2567debd950023176c25cf92289340
File type: pe · Size: 130051 bytes
Verdict: malicious (99/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Generic-9908425-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9908425-0 (rule Win.Trojan.Generic-9908425-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
1 behavioral detection(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (26 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 8 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1591 behavior events · 0 ATT&CK techniques · 8 dropped files.

Dropped files

C:\Windows\win32dc\BattleField 1942 + serial.exe - f2bbf00f0184cd01dd397895d12e83690c385bb5de826b8b08df33f2e8df00e2
C:\Windows\win32dc\BattleField 1942 cdfix.exe - f19a5bbfa7f3bc5d0a79872eaa256906efb9548813e8b27497a3469b89a58583
C:\Windows\win32dc\Quake3(trainer).exe - 99cdfdd30b3191d4632bb58b1a60ffbe7357584b077648b441466137f5c9a2a5
C:\Windows\win32dc\Counter-Strike(fix).exe - 096e2ac3a03d3d53b9c247ede4e6610965ba5f53e70d35ab6a465030e807af7a
C:\Windows\win32dc\Half-Life 2_crack.exe - 586cf2a1c5fbbad62083cbafaeda972f2713908fdd16bb395c99a33d07eb841e
C:\Windows\win32dc\Quake3 hack.exe - 84696bd7a65c67547cb4f64acb6f6aa81d2f8ecc84a4abe3714e35897cefffb6
C:\Windows\win32dc\Quake3_hack.exe - 28aee24bc6318514a61a3d9ed91417e0e61f75e67f08552eecb8a0517a6ffa69
C:\Windows\win32dc\Silent Hill 4 + fix.exe - 6e791552bdcc8cda5259f2ba0819b3be747cc09e1b9798d0589f31b3ba85a34c

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787850063&P2=404&P3=2&P4=Bi%2b42ycjqC29IqjYLOgmPS8zbcFSCyqvpbqB0w%2baVBhJiK%2fvFUou5bmvPWOqPgl4oPgRo2wpa6Xe7xf7R%2bywJA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787850120&P2=404&P3=2&P4=LQtICYreBnQqvR1V6cp2c3jUd%2fKhKAplL16olBdqHbczkTWSZ%2bfoPK9k7g4h74PJM5EaK7bS7EXimbUG8pTp6w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

us.undernet.org

Embedded IP addresses

51.104.15.252
4.247.188.224
4.230.171.124
4.247.188.233
52.253.84.76
74.179.77.204
104.46.162.229
135.232.92.97
20.42.73.25
20.76.201.171
52.123.129.14
52.123.128.14
40.103.64.242
203.26.79.13
20.165.94.46
52.123.252.204
52.123.252.218
172.178.240.163
172.83.156.122
52.148.114.188
172.215.188.232
85.210.196.11
104.46.162.230
72.154.7.113
51.11.192.51

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report